ment of an environment of trust, the value of increased convenience and quality offered by EHRs and data sharing will overcome concerns about privacy. Currently, however, the risks of adopting an EHR system are better understood and communicated, so the focus of stakeholder engagement activities going forward should be on communicating the benefits—most importantly, better care and lower costs.

The implementation of fair information practices to ensure privacy and security is the focus of the Center for Democracy and Technology’s Deven McGraw. Citing surveys showing that while individuals desire electronic access to their health information, they have significant privacy concerns, she suggests that providing individuals with meaningful choices around privacy is an important approach to addressing these concerns. Ms. McGraw points to a comprehensive approach to patient privacy and data security based on the Markle Common Framework for Secure and Private Health Information Exchange. Key elements of the framework include an open and transparent process, specification of purpose, individual participation and control, and accountability and oversight. Closing with a warning that overreliance on consent leads to weak protection—shifting the burden of privacy protection to the individual—and that existing regulations are insufficient to cover the emerging issues of a learning health system, she notes the need for a trust fabric based on fair information practices.

Since its passage in 1996 and recent modifications, the Health Insurance Portability and Accountability Act (HIPAA), has served as the legal and policy framework for health information privacy. Bradley Malin of Vanderbilt University describes the current state of play around health data de-identification and highlights some of the relevant learning health system–related issues posed by HIPAA. Included among these are identity resolution while maintaining privacy and concern that de-identification could cause modifications to patient information that influence the meaning of clinical evidence. He asserts, however, that most of these challenges are not insurmountable, and that efforts to quantify risk are an important first step to mitigation. Dr. Malin suggests that use cases that better define health information uses, and progress in the area of distributed query-based research will be important in progressing toward a privacy-assured learning health system.

Ian Foster of Argonne National Laboratory addresses the technical components surrounding trust in the digital infrastructure for the learning health system. Dr. Foster lays out a number of challenges facing the a establishment of a secure digital platform. He points to the fact that a learning health system requires data sharing on an unprecedented scale, and that the purpose of this sharing be extended beyond individual patient care support to include research and population health. Identifying the challenge



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement